Daft #Drupal question, but do custom entities not have access control when used with Views? Able to see an unpublished entity even when using rendered entity.